cloudformation中输出api键值

Question

我有一个输出变量的 cloudformation 模板。输出变量之一是

 ApiGKeyId:
    Description: "Api Key Id"
    Value: !Ref ApplicationApiGatewayApiKey

这将返回 API 网关密钥的 ID，而不是实际值。有没有办法获得价值？

Answer 1

如果有人希望在 Python 中使用自定义资源执行此操作：

Resources:
  ApiKey:
    Type: AWS::ApiGateway::ApiKey
    Properties:
      Enabled: true
  #######################################################
  ##### Start of Custom functions #####
  #######################################################
  ValueFuncExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      Path: "/"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - sts:AssumeRole
            Principal:
              Service:
                - lambda.amazonaws.com
      Policies:
        - PolicyName: root
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: apigateway:GET
                Resource: !Sub arn:aws:apigateway:${AWS::Region}::/apikeys/${ApiKey}

  ValueFunc:
    Type: AWS::Lambda::Function
    Properties:
      Code:
        ZipFile: |
          import boto3
          import cfnresponse

          def lambda_handler(event, context):
            response_code = 200
            api_gateway_client = boto3.client('apigateway')
            api_key_id = event['ResourceProperties']['ApiKeyID']
            response = api_gateway_client.get_api_key(
              apiKey=api_key_id,
              includeValue=True
            )
            responseValue = response['value']
            responseData = {}
            responseData['Data'] = responseValue
            cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData, "CustomResourcePhysicalID", noEcho=True)
      Handler: index.lambda_handler
      Runtime: python3.9
      Timeout: 30
      Role: !Sub "arn:aws:iam::${AWS::AccountId}:role/${ValueFuncExecutionRole}"
  GetApiKeyValue:
    Type: Custom::LambdaCallout
    Properties:
      ServiceToken: !GetAtt ValueFunc.Arn
      ApiKeyID: !Ref ApiKey

Outputs:
  APIKeyValue:
    Description: "The actual API Key Value"
    Value: !GetAtt GetApiKeyValue.Data

Answer 2

我必须编写一个部署后脚本，该脚本将读取 API 密钥值并插入到 dynamodb 数据库表中。我使用了 bash 脚本和 aws 控制台的组合。

# Get the api KeyName from cloudformation output
awsApiGatewayKeyId=$(get_cf_output ApiGKeyName)

# With the name you call get-api-key and pass the KeyName
# When used with include-values it return the API key in the property value
awsApiGatewayKey=$(aws apigateway get-api-keys --name-query $awsApiGatewayKeyId --include-values --query 'items[0].value' --output text )

# Insert the values into Dynamodb for API Authorizer. 
$(aws dynamodb put-item --table-name $tokenAuthTable --item '{"ApiKey": { "S": "'"$awsApiGatewayKey"'" }, "HmacSigningKey":  { "S": "'"$csapiSecretKey"'"},"Name":  { "S": "'"$stackName"'"}}' )

通过这样做，我不必手动将记录放入 dynamodb 中。

请参考下面的 URL 获取 api 密钥。 https://docs.aws.amazon.com/cli/latest/reference/apigateway/get-api-key.html

Answer 3

根据下面的帖子不支持属性“Value”~
https://github.com/awslabs/serverless-application-model/issues/206

第 3 方维护的可用属性在这里一目了然： https://theburningmonk.com/cloudformation-ref-and-getatt-cheatsheet/

经过一番研究，我觉得没有其他方法可以检索 ApiKey 的值，只能使用自定义资源调用 lambda 函数。这是我的示例代码。

#######################################################
##### Start of Custom functions #####
#######################################################
ValueFunc:
  Type: AWS::Lambda::Function
  Properties:
    Code:
      ZipFile: >
        var response = require('cfn-response');
        var AWS = require('aws-sdk');

        exports.handler = function(event, context) {
          var apiKeyID = event.ResourceProperties.ApiKeyID;
          var apigateway = new AWS.APIGateway();
          var params = {
            apiKey: apiKeyID,
            includeValue: true
          };

          apigateway.getApiKey(params, function(err, ApiKeyData) {
            if (err) {
              console.log(err, err.stack); // an error occurred
              var responseData = { "mykey" : "error reading ApiKey" };
              response.send(event, context, response.SUCCESS, responseData);
            } else {
              console.log(ApiKeyData.value);      // successful response
              var responseData = { "mykey" : ApiKeyData.value };
              response.send(event, context, response.SUCCESS, responseData);
            }
          });
        };
    Handler: index.handler
    Runtime: nodejs8.10
    Timeout: 30
    Role: !Sub "arn:aws:iam::${AWS::AccountId}:role/${LambdaExecutionRole}"
GetApiKeyValue:
  Type: Custom::LambdaCallout
  Properties:
    ServiceToken: !GetAtt ValueFunc.Arn
    ApiKeyID: !Ref ApiKey